Froxlor CVE-2026-41233

Exploitation requires authenticated access to Froxlor with the role of a reseller (PR:L from CVSS vector indicates authenticated but non-administrative user). The critical precondition is that the calling reseller must NOT have the customers_see_all permission-if this permission is present, the application's conditional logic presumably applies proper validation. Exploitation is possible immediately upon API/web interface access; no special configuration, network conditions, or user interaction is required. Conversely, exploitation is limited to reseller-level accounts with domain creation rights; administrative accounts with full permissions are not vulnerable. The vulnerability does NOT require enabling additional features or non-default configurations-the flawed Domains.add() method is part of the standard installation.

This vulnerability presents moderate but actionable risk despite its CVSS 5.4 score. The attack vector is network-based with low complexity and requires only low-level authentication (authenticated reseller access), making it accessible to a broad class of users with legitimate system access. However, the impact is limited to integrity and availability concerns-the attacker cannot directly exfiltrate data (C:N) but can disrupt resource management and exhaust other administrators' quotas. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) accurately reflects the true threat: any authenticated reseller can immediately exploit this without user interaction or privilege escalation. The vulnerability is particularly concerning in multi-tenant hosting environments where reseller abuse of administrative quotas could trigger cascading denial-of-service effects against co-hosted administrators. No EPSS score or active exploitation data was provided; however, the simplicity of exploitation (no special preconditions beyond authenticated reseller status) suggests this should be treated as high-priority in environments with untrusted or semi-trusted resellers. The patch is confirmed available, reducing long-term risk for timely deployers.

An authenticated reseller with legitimate access to Froxlor's API logs in and calls the Domains.add() function. Instead of specifying their own adminid, they supply the adminid of a competing administrator. The application accepts this input without validation because the reseller lacks the customers_see_all permission, and the new domain is attributed to the target admin. The reseller repeats this process multiple times, rapidly exhausting the target administrator's domain quota while keeping their own quota counter low, effectively blocking the target admin from creating legitimate domains.